ClawHub
Back to skill

Security audit

geoskill-land-degradation-assessment

Security checks across malware telemetry and agentic risk

Overview

The main land-degradation tool is mostly offline and purpose-aligned, but the package also includes under-disclosed credential and network helper code, including a hardcoded Earthdata password.

Review before installing. The offline land-degradation command itself looks coherent, but the package should remove the hardcoded Earthdata credentials and either delete or clearly document/gate the credential, geocoding, and downloader helpers. Install only in an isolated environment unless you are comfortable with bundled code that can read local credential stores if invoked.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill declares no permissions, yet the analyzed capability set includes environment access, file read/write, networking, and shell execution. That mismatch is dangerous because users and orchestration systems cannot make an informed trust decision, and the undeclared capabilities could enable credential access, local file manipulation, or unexpected outbound communication during execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose is limited to SDG 15.3.1 land degradation assessment, but the implementation reportedly includes credential harvesting paths (environment variables, ~/.netrc, secrets files), hardcoded default Earthdata credentials, online geocoding/services access, and a generic downloader for arbitrary URLs. These extra behaviors are not necessary for the stated function and substantially increase risk by enabling secret exposure, unintended network access, and abuse as a general data exfiltration or remote-fetch component.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The module hardcodes a default Earthdata username and password in source, which is a direct secret exposure and creates usable fallback credentials for anyone with code access. It also broadens credential handling beyond the stated land degradation purpose, increasing attack surface and the chance that unrelated services can be accessed from this skill context.

Context-Inappropriate Capability

High
Confidence
86% confidence
Finding
Adding OpenAI API key support in a land degradation assessment credential module introduces unnecessary privilege and an unrelated outbound capability. In this context, extra credential pathways are suspicious because they enable data exfiltration or unauthorized third-party access without clear functional justification.

Intent-Code Divergence

Medium
Confidence
82% confidence
Finding
The module claims passwords are not cached, but load_user_secrets() copies secrets into the in-memory _DEFAULTS structure and retains them for the process lifetime. This increases exposure in long-lived processes, memory inspection scenarios, and accidental reuse by unrelated code paths.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
98% confidence
Finding
secrets.json

Credential Access

High
Category
Privilege Escalation
Content
def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True
Confidence
83% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
95% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
95% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
95% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
84% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
87% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15